CVE-2021-35959: Plone has stored XSS in folder contents

May 24, 2022 (updated October 18, 2024)

In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.

References

github.com/advisories/GHSA-qfhw-fv3g-v836
github.com/plone/Plone
github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-110.yaml
nvd.nist.gov/vuln/detail/CVE-2021-35959
plone.org/security/hotfix/20210518/stored-xss-in-folder-contents

Code Behaviors & Features

Detect and mitigate CVE-2021-35959 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →